Ethernet-based Software Defined Network (SDN) Cloud Computing Research Center for Mobile Applications (CCMA), ITRI 雲 端 運 算 行 動 應 用 研 究 中 心

Transcription

1 Ethernet-based Software Defined Network (SDN) Cloud Computing Research Center for Mobile Applications (CCMA), ITRI 雲 端 運 算 行 動 應 用 研 究 中 心 1

2 SDN Introduction Decoupling of control plane from data plane Breaks the existing vertical integration model in network equipment industries Enables quick development and deployment of innovative third-party control plane applications Centralization of control plane Management vs. Control vs. Data plane Facilitates fast deployment and upgrade of control protocols Enables global allocation of a network s resources Software in software-defined network User applications Control protocols 2

3 SDN Software Architecture User Applications Management Software Data plane Controller Control plane applications Southbound AP Northbound API NorthNorthbound API Control Plane Application 1 Northnorthbound API Control Plane Application 2 Northbound API Control Plane Application 3 Virtual Switch Controller Southbound API OpenFlow Switch Ethernet Swicth

4 OpenFlow Architecture OpenFlow switch: A data plane that implements a set of flow rules specified in terms of the OpenFlow instruction set OpenFlow controller: A control plane that sets up the flow rules in the flow tables of OpenFlow switches OpenFlow protocol: A secure protocol for an OpenFlow controller to set up the flow tables in OpenFlow switches 4

5 OpenFlow Controller OpenFlow Protocol (SSL/TCP) Control Path Flow Table Data Path (Hardware) 5

6 OpenFlow Basics Rule Action Stats Packet + byte counters 1. Forward packet to zero or more ports 2. Encapsulate and forward to controller 3. Send to normal processing pipeline 4. Modify Fields 5. Any extensions you add! Switch Port VLAN ID VLAN pcp MAC src MAC dst Eth type Src Dst ToS Prot L4 sport L4 dport + mask what fields to match 6

7 Examples Switching Switch Port MAC src MAC dst Eth type VLAN ID Src Dst Prot TCP sport TCP dport Action * * 00:1f:.. * * * * * * * port6 Flow Switching Switch Port MAC src MAC dst Eth type VLAN ID Src Dst Prot TCP sport TCP dport Action port3 00: :1f vlan port6 Firewall Switch Port MAC src MAC dst Eth type VLAN ID Src Dst Prot TCP sport TCP dport Action * * * * * * * * * 22 drop 7

8 Examples Routing Switch Port MAC src MAC dst Eth type VLAN ID Src Dst Prot TCP sport TCP dport Action * * * * * * * * * port6 VLAN Switching Switch Port * MAC src MAC dst Eth type VLAN ID Src Dst Prot TCP sport TCP dport * 00:1f.. * vlan1 * * * * * Action port6, port7, port9 8

9 SDN OpenFlow Can we apply SDN to Ethernet switches, especially in cloud data center space? Peregrine 9

10 Cloud Data Center Architecture Physical Server VM0 VM1 VMn Layer-3 Border Routers Data Center Network Fabrics IEL Load Balancing Traffic Shaping Intrusion Detection NAT/VPN Compute Server Rack Storage Server 10

11 Cloud Data Center Network Cloud data centers are Big and Shared Scalable and available data center fabrics Not all links are used No load-sensitive routing Fail-over latency is high (> 5 seconds) Network virtualization: Each virtual data center (VDC) gets to define its own network VMs in a VDC belong to one or multiple subnets (broadcast domains) Each VDC has its own private address space Each VDC has a set of public addresses for service entry points and for VPN connections with external sites Each VDC has its Internet traffic shaping policy, intra-vdc and inter-vdc firewalling policy, and server load balancing policy 11

12 What s Wrong with Ethernet? Spanning tree-based Not all physical links are used No load-sensitive dynamic routing Fail-over latency is high ( > 5 seconds) Cannot scale to a large number of VMs (e.g. 1M) Forwarding table is too small: 16K to 64K Does not support VM migration and visibility Does not support network virtualization 12

13 Peregrine A unified Layer-2-only data center network for LAN and SAN traffic A SDN architecture using only commodity Ethernet switches: centralized control plane and distributed data plane Turn off Ethernet s control protocol: spanning tree, source learning, flooding of unknown-destination-mac packets, broadcast of ARP and DHCP VLAN is optional because VLAN ID space is limited Centralized load-balancing routing using real-time traffic matrix Fast fail-over using pre-computed primary/backup routes Native support for network virtualization Private address space reuse Multiple subnets per virtual network 13

14 Peregrine Software Architecture Route Analytics Server Directory Server Ethernet Switch-based Network Fabrics VM2 VM3 Peregrine Agent Hypervisor Hardware Physical Server 1 Physical Server 4 Physical Server 7 14

15 Dynamic Traffic Engineering Periodic collection of real-time traffic matrix Traffic volume between each pair of VMs Traffic volume between each pair of PMs Load balancing routing algorithm Loads on the physical links Number of hops Forwarding table entries Prioritization Computed routes are programmatically installed on the forwarding tables of Ethernet switches 15

16 Fast Failure Recovery For a given node N, proactively computes two disjoint paths (primary and backup) from every other node to N, and installs them on the associated switches All primary (secondary) paths to a given node N form a spanning tree Each node has two MAC addresses, which are installed on the switches of its primary and backup trees, respectively When a primary path from S to D goes down, S is notified that it should use D s backup MAC address to reach D RAS and DS support fail-over 16

17 Fast Failure Recovery Example 17

18 Network Virtualization Multiple virtual networks running on a single physical network The network of each virtual data center (VDC) consists of VMs MAC addresses are pre-assigned A single layer-2 network A complete private address space, organized into multiple subnets each with its own broadcast domain A set of public addresses Its own copy of the DHCP and DNS service Security: Intra-VDC and inter-vdc firewall policy SLA: Traffic shaping policy Scalability: Server load balancing policy

19 Private Address Space Reuse Requirement: Every VDC has a VDC ID and its own full 24-bit private address space (10.x.x.x), even though multiple VDCs run on top of the same data center network Two approaches: Ethernet over TCP/UDP: Every Ethernet packet is encapsulated inside an TCP/UDP packet or TCP/UDP connection as an Ethernet link Needs to implement in software such Ethernet switch functions as source learning, flooding, VLAN, etc. Can work with arbitrary networks Multi-tenancy-aware -MAC mapping: our approach VDC ID + private address MAC address Runs directly on L2 networks, no need for Ethernet switch emulation Inter-virtual-data-center isolation 2013/6/2 19

20 Hybrid Cloud Support A2 VPN2 A1, A3, A4 VPN2 On-premise physical data center A2, A3, A4 VPN1 A1, A2, A4 VPN3 A7 A9 A1 A1 VPN1 Internet VPN3 A3 VPN4 Cloud-based virtual data center A4 A1, A2, A3 VPN4 2013/6/2 20

21 Cross-Site Global Load Balancing <D2,S> <S,D2> Client <S,D1> <D1,S> VM SLB <S,D2> DNS Server VPN Internet VPN SLB <S,D1> VM Cloud-based virtual data center On-premise physical data center 2013/6/2 21

22 Peregrine in SDN Framework Data plane: Ethernet switches Southbound API: SNMP and CLI Controller: (1) Physical network resource set-up, (2) Physical topology record keeping, (3) SNMP trap processing, (4) Ethernet switch configuration, including forwarding table programming, and (5) Traffic load information Northbound API: Failure/congestion notification, including SNMP trap packet delivery ARP request packet delivery Forwarding table programming Physical topology/traffic load querying Control plane applications: Dynamic traffic engineering Fast fail-over for data/control plane failures Network virtualization 22

23 Wish-List Ethernet Switch Features Ability to turn off flooding of unicast packets with unknown destination MAC address Ability to turn off source MAC address check enables asymmetric routing Bulk uploading of forwarding table Fast link/switch failure detection Link traffic load counting Interception and redirection of packets of selected type 23

24 Comparisons Scalable and available data center fabrics IEEE 802.1aq: Shortest Path Bridging IETF TRILL Competitors: Cisco, Juniper, Brocade Differences: commodity switches, centralized load balancing routing and proactive backup route deployment Network virtualization OpenFlow protocol: between OpenFlow controller and OpenFlow switches Competitors: Nicira, NEC and NTT Generality carries a steep performance price Every virtual network link is a tunnel Differences: Simpler and more efficient because it runs on L2 switches directly Flow table state management and flow table lookup performance overhead

25 Current Status A fully operational Peregrine prototype that works on a 10- switch and 100-server test-bed Start-up and shut-down without out-of-band control network Fast fail-over for both data plane and control plane failures Dynamic traffic engineering On-going work: An agentless implementation of Peregrine Encapsulate Peregrine with Internet Edge Logic functionalities as a Quantum plug-in implementation Port dynamic traffic engineering, fast fail-over, and network virtualization to an OpenFlow platform, i.e. OF controller + OF switches 25

26 Summary Peregrine is a network system technology, not a network device technology, and consists of A hypervisor agent running on every compute node L7/Web application firewall and traffic shaping A centralized route server and directory server A VDC-aware Internet Edge Logic cluster Server load balancing, VPN, NAT, and L4 firewall Network virtualization technology that does not use tunneling or VLAN A software defined network (SDN) architecture that runs on commodity Ethernet switches, and is able to manage both legacy Ethernet and OpenFlow switches 26

27 Thank You! For More Information: Y.F. Juan / 阮 耀 飛 Deputy Director Strategy & Business Development Cloud and Mobile Computing Center Industrial Technology Research Institute t: +886 (0) m: +886 (0) e: yf.juan@itri.org.tw 27